The short version. Upload an existing scanner report. It is parsed deterministically — not read by a model — then a single triage agent deduplicates, prioritises and maps findings to the compliance frameworks you care about.
What this engine does
Scanner output is optimised for coverage, not for decisions. Triage is the work between the two, and it is the part that usually does not happen.
- Deterministic parsing of Nessus, OpenVAS, Nmap, Burp, CSV and PDF exports — hardened against XML entity attacks, because a scanner report is untrusted input like any other file.
- Deduplication across hosts and rules, so one misconfiguration on forty hosts reads as one finding with forty instances.
- Prioritisation by exposure and exploitability rather than by raw severity number.
- Compliance mapping to GDPR, NIS2 and ISO 27001 controls where a finding is relevant to one.
- A readable summary aimed at the person who has to decide what to fix first.
What it deliberately does not do
This engine touches no target at all. It reads a file you give it:
- No scanning. Nothing is probed, connected to or tested. There is no target.
- No verification of the original findings. If the scanner produced a false positive, triage can flag it as improbable but cannot disprove it.
- No model-driven parsing. Structure is extracted by code; the model only interprets what the parser produced.
- No indefinite retention. The uploaded file is deleted automatically after 30 days.
How we prove you are allowed to run it
Authorisation is a hard gate, not a checkbox in our terms. A scan starts only if the asset is verified by Domain Control Verification — you place a DNS TXT record or a file we specify — or you supply an explicit legal-authority attestation stating you own the target or are authorised to test it. A request carrying neither is refused with HTTP 403, at every tier, with no override. There is no target to authorise, so this engine has no DCV or attestation step. The only requirement is that you are entitled to the report you upload.
Where your data goes, and when it is deleted
Everything runs on EU infrastructure: edge functions in EU regions, scan compute in Frankfurt, object storage under EU jurisdiction, model inference through an EU endpoint. Nothing is used to train any model — ours or a third party's — and that is a contractual term in the DPA, which every plan gets.
- The report — kept two years, so you can hand it to an auditor next year.
- Raw uploaded material — third-party scanner files 30 days, application binaries 60 days, then deleted automatically.
- The anonymous homepage preview — content erased after 24 hours.
- The authorisation record — kept, because it is the evidence that the scan was permitted.
The full schedule is in our Privacy Policy, and the sub-processor list is on the Trust Center.
How a run actually works
The file is parsed in an isolated workspace by deterministic code. That order is deliberate: handing a raw scanner export straight to a model invites both hallucinated findings and prompt injection from attacker-controlled strings inside the report. The triage agent sees a normalised structure, never the raw file.
What you get at the end
A prioritised report in the same format as our own engines produce, so an imported result sits alongside a scan you ran here without translation. Each finding carries its instances, its priority rationale, and any compliance control it maps to.
What this engine cannot find
Triage inherits the limits of whatever produced the input:
- Coverage gaps in the original scan stay gaps — nothing new is discovered.
- False positives can be flagged as improbable but not disproven without testing.
- Findings the original tool described vaguely stay vague.
- Custom or proprietary export formats outside the supported list cannot be parsed.
- Context only you have — compensating controls, accepted risks — is not known to the triage.
We publish this list for the same reason we publish our own assessment report, limitations section included: a vendor that cannot tell you what its tool misses is asking you to take the rest on faith.
Frequently Asked Questions
Which formats can I upload?
Nessus, OpenVAS, Nmap and Burp exports, plus generic CSV and PDF. Parsing is deterministic and hardened against XML entity attacks.
Does the AI read my raw scanner file?
No. Code parses the file into a normalised structure and the triage agent works from that. This prevents both hallucinated findings and prompt injection from strings inside the report.
How long do you keep the uploaded file?
Thirty days, then it is deleted automatically. The report generated from it follows the normal two-year retention.
Can it verify whether a finding is a false positive?
It can flag findings as improbable given their context, but confirming or disproving one requires actually testing the target — which is what the Web, API or Network engines are for.
Why is this the cheapest engine?
There is no scanning compute and one agent instead of many. The work is triage, not discovery.